diff --git a/0002-fix-CVE-2024-2004.patch b/0002-fix-CVE-2024-2004.patch new file mode 100644 index 0000000000000000000000000000000000000000..40c9bb836623eeffac52d7ea18ee2b95182b2b17 --- /dev/null +++ b/0002-fix-CVE-2024-2004.patch @@ -0,0 +1,63 @@ +From 10cd800b3b45e83ed94d563d0f6208a2f9c67204 Mon Sep 17 00:00:00 2001 +From: Chunmei Xu +Date: Tue, 13 Aug 2024 14:05:54 +0800 +Subject: [PATCH 1/1] fix CVE-2024-2004 + +--- + lib/setopt.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/lib/setopt.c b/lib/setopt.c +index 0d399ad..e022096 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -154,6 +154,12 @@ static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp) + + static CURLcode protocol2num(const char *str, curl_prot_t *val) + { ++ /* ++ * We are asked to cherry-pick protocols, so play it safe and disallow all ++ * protocols to start with, and re-add the wanted ones back in. ++ */ ++ *val = 0; ++ + if(!str) + return CURLE_BAD_FUNCTION_ARGUMENT; + +@@ -162,8 +168,6 @@ static CURLcode protocol2num(const char *str, curl_prot_t *val) + return CURLE_OK; + } + +- *val = 0; +- + do { + const char *token = str; + size_t tlen; +@@ -2690,22 +2694,18 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) + break; + + case CURLOPT_PROTOCOLS_STR: { +- curl_prot_t prot; + argptr = va_arg(param, char *); +- result = protocol2num(argptr, &prot); ++ result = protocol2num(argptr, &data->set.allowed_protocols); + if(result) + return result; +- data->set.allowed_protocols = prot; + break; + } + + case CURLOPT_REDIR_PROTOCOLS_STR: { +- curl_prot_t prot; + argptr = va_arg(param, char *); +- result = protocol2num(argptr, &prot); ++ result = protocol2num(argptr, &data->set.redir_protocols); + if(result) + return result; +- data->set.redir_protocols = prot; + break; + } + +-- +2.41.0 + diff --git a/curl.spec b/curl.spec index 77fa6e43293d328aa9104868e08fdc6690ec7b13..1d73e655ced49d27c0a3dd26c148a8c2ad57e910 100644 --- a/curl.spec +++ b/curl.spec @@ -1,4 +1,4 @@ -%define anolis_release 4 +%define anolis_release 5 Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Epoch: 1 @@ -75,7 +75,8 @@ BuildRequires: perl(Time::Local) BuildRequires: perl(Time::HiRes) BuildRequires: perl(vars) -Patch: 0001-fix-cve-2024-2398.patch +Patch0001: 0001-fix-cve-2024-2398.patch +Patch0002: 0002-fix-CVE-2024-2004.patch # The test-suite runs automatically through valgrind if valgrind is available # on the system. By not installing valgrind into mock's chroot, we disable @@ -367,6 +368,9 @@ rm -rf ${RPM_BUILD_ROOT}%{_datadir}/fish %doc docs/TheArtOfHttpScripting.md %changelog +* Tue Aug 13 2024 mgb01105731 - 8.4.0-5 +- fix CVE-2024-2004 + * Mon Jun 24 2024 yanyihao - 8.4.0-4 - fix conflict when both install libcurl and libcurl-devel